Skip to content

Commit 6a7b970

Browse files
zimmerlezimmerle
committed
Adds support to ctl:requestBodyProcessor=XML
1 parent 9202ffb commit 6a7b970

File tree

7 files changed

+263
-12
lines changed

7 files changed

+263
-12
lines changed

‎headers/modsecurity/transaction.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -252,6 +252,11 @@ class Transaction {
252252
*/
253253
RequestBodyType m_requestBodyType;
254254

255+
/**
256+
* Holds the request body "processor"
257+
*/
258+
RequestBodyType m_requestBodyProcessor;
259+
255260
/**
256261
* Rules object utilized during this specific transaction.
257262
*/

‎src/Makefile.am‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@ ACTIONS = \
6868
actions/capture.cc \
6969
actions/chain.cc \
7070
actions/ctl_audit_log_parts.cc \
71+
actions/ctl_request_body_processor_xml.cc \
7172
actions/init_col.cc \
7273
actions/deny.cc \
7374
actions/log_data.cc \

‎src/actions/ctl_request_body_processor_xml.cc‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
/*
2+
* ModSecurity, http://www.modsecurity.org/
3+
* Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
4+
*
5+
* You may not use this file except in compliance with
6+
* the License. You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* If any of the files related to licensing are missing or if you have any
11+
* other questions related to licensing please contact Trustwave Holdings, Inc.
12+
* directly using the email address [email protected].
13+
*
14+
*/
15+
16+
#include "actions/ctl_request_body_processor_xml.h"
17+
18+
#include <iostream>
19+
#include <string>
20+
21+
#include "modsecurity/transaction.h"
22+
23+
namespace modsecurity {
24+
namespace actions {
25+
26+
27+
bool CtlRequestBodyProcessorXML::evaluate(Rule *rule, Transaction *transaction) {
28+
transaction->m_requestBodyProcessor = modsecurity::Transaction::XMLRequestBody;
29+
return true;
30+
}
31+
32+
33+
} // namespace actions
34+
} // namespace modsecurity

‎src/actions/ctl_request_body_processor_xml.h‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
/*
2+
* ModSecurity, http://www.modsecurity.org/
3+
* Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
4+
*
5+
* You may not use this file except in compliance with
6+
* the License. You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* If any of the files related to licensing are missing or if you have any
11+
* other questions related to licensing please contact Trustwave Holdings, Inc.
12+
* directly using the email address [email protected].
13+
*
14+
*/
15+
16+
#include <string>
17+
18+
#include "actions/action.h"
19+
#include "modsecurity/transaction.h"
20+
21+
#ifndef SRC_ACTIONS_CTL_REQUEST_BODY_PROCESSOR_XML_H_
22+
#define SRC_ACTIONS_CTL_REQUEST_BODY_PROCESSOR_XML_H_
23+
24+
namespace modsecurity {
25+
namespace actions {
26+
27+
28+
class CtlRequestBodyProcessorXML : public Action {
29+
public:
30+
explicit CtlRequestBodyProcessorXML(std::string action)
31+
: Action(action, RunTimeOnlyIfMatchKind) { }
32+
33+
bool evaluate(Rule *rule, Transaction *transaction) override;
34+
};
35+
36+
} // namespace actions
37+
} // namespace modsecurity
38+
39+
#endif // SRC_ACTIONS_CTL_REQUEST_BODY_PROCESSOR_XML_H_

‎src/parser/seclang-parser.yy‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ class Driver;
2323
#include "actions/action.h"
2424
#include "actions/audit_log.h"
2525
#include "actions/ctl_audit_log_parts.h"
26+
#include "actions/ctl_request_body_processor_xml.h"
2627
#include "actions/init_col.h"
2728
#include "actions/set_sid.h"
2829
#include "actions/set_uid.h"
@@ -69,6 +70,7 @@ using modsecurity::ModSecurity;
6970
using modsecurity::actions::Accuracy;
7071
using modsecurity::actions::Action;
7172
using modsecurity::actions::CtlAuditLogParts;
73+
using modsecurity::actions::CtlRequestBodyProcessorXML;
7274
using modsecurity::actions::InitCol;
7375
using modsecurity::actions::SetSID;
7476
using modsecurity::actions::SetUID;
@@ -1094,8 +1096,7 @@ act:
10941096
}
10951097
| ACTION_CTL_BDY_XML
10961098
{
1097-
/* not ready yet. */
1098-
$$ = Action::instantiate($1);
1099+
$$ = new modsecurity::actions::CtlRequestBodyProcessorXML($1);
10991100
}
11001101
| ACTION_CTL_BDY_JSON
11011102
{

‎src/transaction.cc‎

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,7 @@ Transaction::Transaction(ModSecurity *ms, Rules *rules, void *logCbData)
107107
m_namesArgsPost(NULL),
108108
m_namesArgsGet(NULL),
109109
m_requestBodyType(UnknownFormat),
110+
m_requestBodyProcessor(UnknownFormat),
110111
m_requestHeadersNames(NULL),
111112
m_responseHeadersNames(NULL),
112113
m_responseContentType(NULL),
@@ -475,7 +476,6 @@ int Transaction::addRequestHeader(const std::string& key,
475476
if (keyl == "content-type") {
476477
std::string multipart("multipart/form-data");
477478
std::string l = tolower(value);
478-
479479
if (l.compare(0, multipart.length(), multipart) == 0) {
480480
this->m_requestBodyType = MultiPartRequestBody;
481481
}
@@ -590,15 +590,11 @@ int Transaction::processRequestBody() {
590590
*
591591
*/
592592

593-
if (m_requestBodyType == XMLRequestBody) {
594-
std::string *a = m_collections.resolveFirst(
595-
"REQUEST_HEADERS:Content-Type");
596-
if (a != NULL) {
597-
if (m_xml->init() == true) {
598-
m_xml->processChunk(m_requestBody.str().c_str(),
599-
m_requestBody.str().size());
600-
m_xml->complete();
601-
}
593+
if (m_requestBodyProcessor == XMLRequestBody) {
594+
if (m_xml->init() == true) {
595+
m_xml->processChunk(m_requestBody.str().c_str(),
596+
m_requestBody.str().size());
597+
m_xml->complete();
602598
}
603599
}
604600

‎test/test-cases/regression/action-ctl_request_body_processor.json‎

Lines changed: 175 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,175 @@
1+
[
2+
{
3+
"enabled":1,
4+
"version_min":300000,
5+
"title":"Testing CtlRequestBodyProcessor=XML (1)",
6+
"expected":{
7+
"debug_log": "Registered XML namespace href \"http://schemas.xmlsoap.org/soap/envelope/\" prefix \"soap\""
8+
},
9+
"client":{
10+
"ip":"200.249.12.31",
11+
"port":123
12+
},
13+
"request":{
14+
"headers":{
15+
"Host":"localhost",
16+
"User-Agent":"curl/7.38.0",
17+
"Accept":"*/*",
18+
"Cookie": "PHPSESSID=rAAAAAAA2t5uvjq435r4q7ib3vtdjq120",
19+
"Content-Type": "text/xml"
20+
},
21+
"uri":"/?key=value&key=other_value",
22+
"method":"POST",
23+
"body": [
24+
"<?xml version=\"1.0\" encoding=\"UTF-8\"?>",
25+
"<bookstore>",
26+
"<book category=\"COOKING\">",
27+
"<title lang=\"en\">Everyday Italian</title>",
28+
"<author>Giada De Laurentiis</author>",
29+
"<year>2005</year>",
30+
"<price>30.00</price>",
31+
"</book>",
32+
33+
"<book category=\"CHILDREN\">",
34+
"<title lang=\"en\">Harry Potter</title>",
35+
"<author>J K. Rowling</author>",
36+
"<year>2005</year>",
37+
"<price>29.99</price>",
38+
"</book>",
39+
40+
"<book category=\"WEB\">",
41+
"<title lang=\"en\">XQuery Kick Start</title>",
42+
"<author>James McGovern</author>",
43+
"<author>Per Bothner</author>",
44+
"<author>Kurt Cagle</author>",
45+
"<author>James Linn</author>",
46+
"<author>Vaidyanathan Nagarajan</author>",
47+
"<year>2003</year>",
48+
"<price>49.99</price>",
49+
"</book>",
50+
51+
"<book category=\"WEB\">",
52+
"<title lang=\"en\">Learning XML</title>",
53+
"<author>Erik T. Ray</author>",
54+
"<year>2003</year>",
55+
"<price>39.95</price>",
56+
"</book>",
57+
"</bookstore>"
58+
]
59+
},
60+
"server":{
61+
"ip":"200.249.12.31",
62+
"port":80
63+
},
64+
"rules":[
65+
"SecRuleEngine On",
66+
"SecRequestBodyAccess On",
67+
"SecRule REQUEST_HEADERS:Content-Type \"^text/xml$\" \"id:500005,phase:1,t:none,t:lowercase,nolog,pass,ctl:requestBodyProcessor=XML\"",
68+
"SecRule XML:/bookstore/book/price[text()] \"Fred\" \"phase:3,id:123,xmlns:soap='http://schemas.xmlsoap.org/soap/envelope/'\""
69+
]
70+
},
71+
{
72+
"enabled":1,
73+
"version_min":300000,
74+
"title":"Testing CtlRequestBodyProcessor=XML (2)",
75+
"expected":{
76+
"debug_log": "XML: No XML document found, returning"
77+
},
78+
"client":{
79+
"ip":"200.249.12.31",
80+
"port":123
81+
},
82+
"request":{
83+
"headers":{
84+
"Host":"localhost",
85+
"User-Agent":"curl/7.38.0",
86+
"Accept":"*/*",
87+
"Cookie": "PHPSESSID=rAAAAAAA2t5uvjq435r4q7ib3vtdjq120",
88+
"Content-Type": "text/xml"
89+
},
90+
"uri":"/?key=value&key=other_value",
91+
"method":"POST",
92+
"body": [
93+
"<?xml version=\"1.0\" encoding=\"UTF-8\"?>",
94+
"<bookstore>",
95+
"<book category=\"COOKING\">",
96+
"<title lang=\"en\">Everyday Italian</title>",
97+
"<author>Giada De Laurentiis</author>",
98+
"<year>2005</year>",
99+
"<price>30.00</price>",
100+
"</book>",
101+
102+
"<book category=\"CHILDREN\">",
103+
"<title lang=\"en\">Harry Potter</title>",
104+
"<author>J K. Rowling</author>",
105+
"<year>2005</year>",
106+
"<price>29.99</price>",
107+
"</book>",
108+
109+
"<book category=\"WEB\">",
110+
"<title lang=\"en\">XQuery Kick Start</title>",
111+
"<author>James McGovern</author>",
112+
"<author>Per Bothner</author>",
113+
"<author>Kurt Cagle</author>",
114+
"<author>James Linn</author>",
115+
"<author>Vaidyanathan Nagarajan</author>",
116+
"<year>2003</year>",
117+
"<price>49.99</price>",
118+
"</book>",
119+
120+
"<book category=\"WEB\">",
121+
"<title lang=\"en\">Learning XML</title>",
122+
"<author>Erik T. Ray</author>",
123+
"<year>2003</year>",
124+
"<price>39.95</price>",
125+
"</book>",
126+
"</bookstore>"
127+
]
128+
},
129+
"server":{
130+
"ip":"200.249.12.31",
131+
"port":80
132+
},
133+
"rules":[
134+
"SecRuleEngine On",
135+
"SecRequestBodyAccess On",
136+
"SecRule XML:/bookstore/book/price[text()] \"Fred\" \"phase:3,id:123,xmlns:soap='http://schemas.xmlsoap.org/soap/envelope/'\""
137+
]
138+
},
139+
{
140+
"enabled":1,
141+
"version_min":300000,
142+
"title":"Testing CtlRequestBodyProcessor=XML (3)",
143+
"expected":{
144+
"debug_log": "XML: Failed parsing document."
145+
},
146+
"client":{
147+
"ip":"200.249.12.31",
148+
"port":123
149+
},
150+
"request":{
151+
"headers":{
152+
"Host":"localhost",
153+
"User-Agent":"curl/7.38.0",
154+
"Accept":"*/*",
155+
"Cookie": "PHPSESSID=rAAAAAAA2t5uvjq435r4q7ib3vtdjq120",
156+
"Content-Type": "text/xml"
157+
},
158+
"uri":"/?key=value&key=other_value",
159+
"method":"POST",
160+
"body": [
161+
"not a xml"
162+
]
163+
},
164+
"server":{
165+
"ip":"200.249.12.31",
166+
"port":80
167+
},
168+
"rules":[
169+
"SecRuleEngine On",
170+
"SecRequestBodyAccess On",
171+
"SecRule REQUEST_HEADERS:Content-Type \"^text/xml$\" \"id:500005,phase:1,t:none,t:lowercase,nolog,pass,ctl:requestBodyProcessor=XML\"",
172+
"SecRule XML:/bookstore/book/price[text()] \"Fred\" \"phase:3,id:123,xmlns:soap='http://schemas.xmlsoap.org/soap/envelope/'\""
173+
]
174+
}
175+
]

0 commit comments

Comments
 (0)